[Above: An excerpt from the Garda Síochána Ombudsman Commission’s briefing note to Justice Minister Alan Shatter, before he spoke in the Dáil on Tuesday, in relation to the alleged bugging of GSOC’s office. Top GSOC HQ in Dublin. Middle: Dr Richard Tynan]

The third ‘threat’ to security at the Garda Ombudsman’s office revealed the presence of a UK mobile network in the vicinity. .

What’s that all about?

Surveillance expert Dr Richard Tynan, of Privacy International, writes:

A misconfigured base station hastily rolled out by an Irish mobile operator could have caused this. However, if one of the Irish mobile telcos deployed such a misconfigured device then one would hope the firm would have come forward by now.

Yet, no one has. The only remaining possibility, then, is that a device used to conduct surveillance was intentionally deployed that purported to be a legitimate mobile phone tower. In surveillance circles, such a device is called an IMSI Catcher (aka IMSI Grabber or Stingray).

IMSI Catchers are used by authorities around the world to put large groups of people under indiscriminate mass surveillance via their mobile phone. IMSI Catchers started off infiltrating GSM networks with the only goal: capture the unique SIM card number that identifies the user called the International Mobile Subscriber Identity (IMSI) – hence the name IMSI Catcher.

When the IMSI Catcher is turned on, it signals to all nearby devices that it is a legitimate part of the mobile communications network, even though it isn’t. The IMSIs of the mobile phones are voluntarily surrendered by the mobile phone when it connects to the tower. By having the strongest signal or manipulating certain parameters, an IMSI Catcher entices all phones to connect to it and thereby get the unique identifier for every individual in an area. This works remarkably well in protests and public demonstrations and events, as was reported by the people of Ukraine recently during their protests.

However, in the last 10-15 years as the use of IMSI Catchers has likely grown, they have evolved to include much more sophisticated capabilities. Nowadays, they can:

– Force phones to stop using encryption (A5/1) and move to unencrypted channels (A5/0) to allow for easier interception;
– Jam the 3G spectrum so phones would default back to 2G where interception could occur;
– Get an accurate location of every individual within its reach of around 1km
– Deny service to one or all users;
– Intercept the content of calls, text messages and data;
– And reportedly alter messages in transit.

Nowadays, full 3G IMSI Catchers are the pride of many surveillance companies attending government-sponsored trade shows to sell their wares to any interested agency. Companies such as CellXion, Forensic Telecommunications Services, and Gamma International provide such products. Not only have the capabilities improved but the devices have shrunk to the size of a large mobile phone and costing around €250-€500.

However, if you prefer to get your hands dirty, you can build one for yourself using a Software Defined Radio and free software called OpenBTS. You can also put together a full GSM call, text and data interception device (even where the target’s data is encrypted) using a €10 phone, free software from Osmocomm and a laptop running open source software. The legality of doing this, however, will vary by jurisdiction.

Given the number of mobile network operators and handsets in a given area, IMSI Catchers need to operate as multiple fake towers simultaneously to harvest as much data as possible in a short amount of time. Some report a rate of 1200 IMSIs per minute across 5 networks while others boast simultaneous voice intercepts as featured on the Surveillance Industry Index. Often it will operate by purporting to be many towers from the same network provider thereby reducing the time it takes to get all the IMSIs from users on a popular network.

Each fake tower will emit a signal containing numbers to tell a mobile phone how to talk to it when it wants to make a call or send a text. Or information on how to register with it so the tower can contact it when an incoming call or text arrives. Specifically, the tower will send a country code and an operator code to the handset. In normal circumstances, this allows phones to stay connected to their operators’ towers and not to start roaming in border areas if another native tower is present.

It is these values that were problematic in the GSOC case. Irish towers should not be identifying themselves as being in the UK or offering the service of a UK network provider. The mobile phone of a UK visitor to GSOC would have spotted its native tower and connected to it. Depending on the model of IMSI Catcher used, full intercept of all data to and from that handset would then be possible.

It is interesting to note that the fake UK network was the only one detected by Verrimus. However, given that IMSI Catchers operate multiple fake towers simultaneously, it is highly likely that one or more Irish networks were also being intercepted. Very often a misconfiguration, such as an incorrect country code, is the only evidence available of an IMSI Catcher being deployed when forensic tools are not being used to look for one. This recently occurred around the Ecuadorian Embassy in London where base stations from a Ugandan telco were mysteriously popping up.

It is remarkable that this type of invasive and mass interception is so easily done over Ireland’s critical infrastructure, which is relied upon by citizens in their daily lives. Given the utility and ubiquity of modern cell phones, from mobile commerce, personal and business communications, to emergency phone calls, the threat this type of surveillance poses to the security and privacy of citizens cannot be understated.Continue reading →